Extracted

• • Target
    weneedbestthingsfromtheheartforbest.js
  • Size 3.2MB
  • SHA256 842ee9e81e74569623e3ea8faf375725e0e19e451f6bd76aae0b416ec7473e44
  • MD5 4063350c70e104e9fb6da9d71ba29da6
  • SHA1 a0baf00ef7eaeb13eebe532dce57dda526ecbf14
  • SHA512 99c0d6d62c10f6b959fb1c59951e41da0f49a8cb17219a893cadb4a1c8086cbd9269745123f769656a80424933a0c43b6d6c728b681285d7e1ff83f027559582
  • SSDEEP 98304:Iw77R4NXK2eLqBlbOoXMzpv6oC8xMu6eJ/Z8e/wenu5hlgq6ra5JETV3Ei:0XrTZMzpvh3hCe6SZxH
  • TLSH
    T135E593409E889C747B2F671CC42E555C496D31CB338CAF3E397E1346B7A5A22934C6BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2